More than 20 years ago, Karleen Cox opened her physical therapy practice and a small business banking account with Bank of America. Recently, she reached out to the bank with a major issue.
It all started on June 1 when her bookkeeper flagged an unfamiliar transaction: two payments totaling nearly $2,000 were sent through Zelle to someone identified as Julia MacFarland. Cox said she did not authorize the transfer and had no idea who Julia MacFarland was.
“It was so obvious and clear that this wasn’t right,” Cox said. “Something had happened. Something had been hacked.”
According to bank records reviewed by NBC Los Angeles, Cox primarily used Zelle to receive payments from patients. As she investigated the transactions, she noticed Bank of America had blocked multiple transfer attempts to the same recipient the day before the successful payments were processed.
Cox also discovered that a phone number associated with that recipient had been added as an authorized user on her account.
“That’s when the panic ensued,” she said. “How did something that we thought was so protected get hacked, and a phone number was added?”
NBCLA asked cybersecurity expert Joseph Steinberg to review records related to the disputed transactions.
“There are several things about this case that look unusual,” Steinberg said, pointing to repeated blocked transactions followed by the two successful transfers to a recipient who had never previously received money from Cox’s account.
“You have a device that had transactions blocked, and then money is going out to accounts that this user had never sent money to in the past,” Steinberg said. “This account was used primarily for inbound payments. That should have stood out as a red flag,” said Steinberg. “That is actually something the bank can determine by going through its records and what its anti-fraud system saw.”
Cox said she immediately reported what she called fraudulent transactions to Bank of America and repeatedly asked the bank to reconsider its findings.
She received responses by mail dated June 9, June 15 and July 15 — all with the same language: “Our investigation found that the transaction in question was completed using a device that is consistent with previous valid account activity,” the letters said.
When Cox requested additional information, including details about the device or IP address used to complete the transaction, she received an out-of-focus document on a black background that again stated the transfer had been completed from her device.
Steinberg reviewed that document and said it raised additional questions.
“It looks like there’s a lot of stuff that was declined or blocked,” he said. “Usually, that’s a red flag that leads to much stricter analysis or even locking an account and contacting a user.”
When Cox questioned BofA about what that document showed, she was told her case would be reopened for a fourth time. Three weeks later, she received another denial notice.
“I don’t understand why it’s not so clear to them that in the 20 years I’ve had this account, they can’t see that this is not consistent with my account activity,” Cox said.
Steinberg said banks have obligations to monitor unusual account activity.
“Banks have a requirement to know their customer, especially with a business,” he said. “If the party who received money had no reason to be receiving money from this business, that’s something the bank is supposed to pay attention to for issues of theft, money laundering and other financial crimes. I can say that the papers the account holder has that I have seen don’t really explain very much and certainly don’t show why their anti-fraud systems didn’t kick in.”
Since June, NBCLA has repeatedly asked Bank of America for clarification on what happened and why the transfers were allowed to go through. The bank said explanations were mailed directly to the customer.
When asked specifically why anti-fraud systems did not stop the transaction after previous transfer attempts had been blocked, the bank said the matter was still in progress, even though Cox had already received a denial letter by mail.
Cox saif the money lost is significant for her practice.
“I know to Bank of America, $2,000 may not seem like a lot,” she said. “But I’m a small business, and $2,000 could be payroll for employees. It’s very impactful for me.”
On Sept. 22, BofA confirmed to NBCLA that Cox’s case is now officially closed.
Cox said she ultimately had to take out a loan to help cover her payroll expenses, and she is now considering taking the bank to small claims court to try get her money back.
